class Win32::SSPI::NegotiateAuth

Handles “Negotiate” type authentication. Geared towards authenticating with a proxy server over HTTP

Constants

B64_TOKEN_PREFIX: NTLM tokens start with this header always. Encoding alone adds “==” and newline, so remove those
REQUEST_FLAGS: Default request flags for SSPI functions

Attributes

context[RW]

contextAttributes[RW]

credentials[RW]

domain[RW]

user[RW]

Public Class Methods

new(user = nil, domain = nil) click to toggle source

Creates a new instance ready for authentication as the given user in the given domain. Defaults to current user and domain as defined by ENV and ENV if no arguments are supplied.

# File ext/win32/lib/win32/sspi.rb, line 245
def initialize(user = nil, domain = nil)
  if user.nil? && domain.nil? && ENV["USERNAME"].nil? && ENV["USERDOMAIN"].nil?
    raise "A username or domain must be supplied since they cannot be retrieved from the environment"
  end

  @user = user || ENV["USERNAME"]
  @domain = domain || ENV["USERDOMAIN"]
end

proxy_auth_get(http, path, user = nil, domain = nil) click to toggle source

Given a connection and a request path, performs authentication as the current user and returns the response from a GET request. The connection should be a Net::HTTP object, and it should have been constructed using the Net::HTTP.Proxy method, but anything that responds to “get” will work. If a user and domain are given, will authenticate as the given user. Returns the response received from the get method (usually Net::HTTPResponse)

# File ext/win32/lib/win32/sspi.rb, line 230
def NegotiateAuth.proxy_auth_get(http, path, user = nil, domain = nil)
  raise "http must respond to :get" unless http.respond_to?(:get)
  nego_auth = self.new user, domain

  resp = http.get path, { "Proxy-Authorization" => "Negotiate " + nego_auth.get_initial_token }
  if resp["Proxy-Authenticate"]
    resp = http.get path, { "Proxy-Authorization" => "Negotiate " + nego_auth.complete_authentication(resp["Proxy-Authenticate"].split(" ").last.strip) }
  end

  resp
end

Public Instance Methods

complete_authentication(token) click to toggle source

Takes a token and gets the next token in the Negotiate authentication chain. Token can be Base64 encoded or not. The token can include the “Negotiate” header and it will be stripped. Does not indicate if SEC_I_CONTINUE or SEC_E_OK was returned. Token returned is Base64 encoded w/ all new lines removed.

# File ext/win32/lib/win32/sspi.rb, line 278
def complete_authentication(token)
  raise "This object is no longer usable because its resources have been freed." if @cleaned_up

  # Nil token OK, just set it to empty string
  token = "" if token.nil?

  if token.include? "Negotiate"
    # If the Negotiate prefix is passed in, assume we are seeing "Negotiate <token>" and get the token.
    token = token.split(" ").last
  end

  if token.include? B64_TOKEN_PREFIX
    # indicates base64 encoded token
    token = token.strip.unpack("m")[0]
  end

  outputBuffer = SecurityBuffer.new
  result = SSPIResult.new(API::InitializeSecurityContext.call(@credentials.to_p, @context.to_p, nil,
    REQUEST_FLAGS, 0, SECURITY_NETWORK_DREP, SecurityBuffer.new(token).to_p, 0,
    @context.to_p,
    outputBuffer.to_p, @contextAttributes, TimeStamp.new.to_p))

  if result.ok? then
    return encode_token(outputBuffer.token)
  else
    raise "Error: #{result.to_s}"
  end
ensure
  # need to make sure we don't clean up if we've already cleaned up.
  clean_up unless @cleaned_up
end

get_initial_token() click to toggle source

Gets the initial Negotiate token. Returns it as a base64 encoded string suitable for use in HTTP. Can be easily decoded, however.

# File ext/win32/lib/win32/sspi.rb, line 256
def get_initial_token
  raise "This object is no longer usable because its resources have been freed." if @cleaned_up
  get_credentials

  outputBuffer = SecurityBuffer.new
  @context = CtxtHandle.new
  @contextAttributes = "\0" * 4

  result = SSPIResult.new(API::InitializeSecurityContextA.call(@credentials.to_p, nil, nil,
    REQUEST_FLAGS,0, SECURITY_NETWORK_DREP, nil, 0, @context.to_p, outputBuffer.to_p, @contextAttributes, TimeStamp.new.to_p))

  if result.ok? then
    return encode_token(outputBuffer.token)
  else
    raise "Error: #{result.to_s}"
  end
end

Private Instance Methods

clean_up() click to toggle source

# File ext/win32/lib/win32/sspi.rb, line 312
def clean_up
  # free structures allocated
  @cleaned_up = true
  API::FreeCredentialsHandle.call(@credentials.to_p)
  API::DeleteSecurityContext.call(@context.to_p)
  @context = nil
  @credentials = nil
  @contextAttributes = nil
end

encode_token(t) click to toggle source

# File ext/win32/lib/win32/sspi.rb, line 332
def encode_token(t)
  # encode64 will add newlines every 60 characters so we need to remove those.
  [t].pack("m").delete("\n")
end

get_credentials() click to toggle source

Gets credentials based on user, domain or both. If both are nil, an error occurs

# File ext/win32/lib/win32/sspi.rb, line 323
def get_credentials
  @credentials = CredHandle.new
  ts = TimeStamp.new
  @identity = Identity.new @user, @domain
  result = SSPIResult.new(API::AcquireCredentialsHandleA.call(nil, "Negotiate", SECPKG_CRED_OUTBOUND, nil, @identity.to_p,
    nil, nil, @credentials.to_p, ts.to_p))
  raise "Error acquire credentials: #{result}" unless result.ok?
end